PT-2024-29983 · Cilium · Cilium

Published 2024-08-16 · Updated 2025-09-03 · CVE-2024-42486

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cilium versions 1.15.x through 1.15.7 Cilium version 1.16.0

Description The issue arises from incorrect propagation of ReferenceGrant changes in Cilium's GatewayAPI controller. This could lead to Gateway resources accessing secrets for longer than intended or Routes forwarding traffic to backends in other namespaces for longer than intended.

Recommendations For Cilium versions 1.15.x through 1.15.7, update to version 1.15.8. For Cilium version 1.16.0, update to version 1.16.1. As a temporary workaround, any modification of a related Gateway/HTTPRoute/GRPCRoute/TCPRoute CRD will trigger a reconciliation of ReferenceGrants on an affected cluster.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BIT-CILIUM-2024-42486

BIT-CILIUM-OPERATOR-2024-42486

BIT-HUBBLE-RELAY-2024-42486

CVE-2024-42486

GHSA-VWF8-Q6FW-4WCM

GO-2024-3074

Affected Products

Cilium

References · 18

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/42xxx/CVE-2024-42486.json · Exploit
• https://github.com/cilium/cilium/security/advisories/GHSA-vwf8-q6fw-4wcm · Patch
• https://github.com/cilium/cilium/pull/34032 · Patch
• https://github.com/cilium/cilium/commit/ed3dfa0aab8b80f7e841a6d49d2a990ac2dca053 · Patch
• https://osv.dev/vulnerability/GO-2024-3074 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-42486 · Security Note
• https://osv.dev/vulnerability/CVE-2024-42486 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-cilium-operator-2024-42486 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-cilium-2024-42486 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-hubble-relay-2024-42486 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vwf8-q6fw-4wcm · Vendor Advisory
• https://github.com/cilium/cilium · Note
• https://github.com/cilium/cilium/commit/414a96b53d51ef6e6645c44426e26bc8e7c7c059 · Note
• https://github.com/cilium/cilium/commit/92c110e58a7be6586819dd51fb0f6ee1ec4be8f8 · Note
• https://t.me/cvedetector/3349 · Telegram Post